Log in Start free

Vulnerability · Published Jul 1, 2026 · Assigned by GitHub_M

CVE-2026-47262containerd image-triggered runtime DoS via unbounded group parsing

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in containerd from containerd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.3%top 81.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24containerd2.3.2-r0ALPINE-CVE-2026-47262
Debian:12containerdno fix listedDEBIAN-CVE-2026-47262
Debian:13containerdno fix listedDEBIAN-CVE-2026-47262
Debian:14containerd2.1.9+ds1-1DEBIAN-CVE-2026-47262
Gogithub.com/containerd/containerd1.7.33GHSA-jpcc-p29g-p8mq
Gogithub.com/containerd/containerd1.7.33GO-2026-5475
Gogithub.com/containerd/containerd/v22.0.10, 2.1.9, 2.2.5, 2.3.2GO-2026-5475
Gogithub.com/containerd/containerd/v22.1.9GHSA-jpcc-p29g-p8mq
Gogithub.com/containerd/containerd/v22.0.10GHSA-jpcc-p29g-p8mq
Gogithub.com/containerd/containerd/v22.2.5GHSA-jpcc-p29g-p8mq
Gogithub.com/containerd/containerd/v22.3.2GHSA-jpcc-p29g-p8mq
Ubuntu:22.04:LTScontainerd1.6.12-0ubuntu1~22.04.11UBUNTU-CVE-2026-47262
Ubuntu:25.10containerdno fix listedUBUNTU-CVE-2026-47262
Ubuntu:26.10containerdno fix listedUBUNTU-CVE-2026-47262
Ubuntu:22.04:LTScontainerd-app2.2.1-0ubuntu1~22.04.2UBUNTU-CVE-2026-47262
Ubuntu:24.04:LTScontainerd-app2.2.1-0ubuntu1~24.04.3UBUNTU-CVE-2026-47262
Ubuntu:25.10containerd-app2.2.1-0ubuntu1~25.10.2UBUNTU-CVE-2026-47262
Ubuntu:26.04:LTScontainerd-app2.2.2-0ubuntu1.1UBUNTU-CVE-2026-47262
Ubuntu:25.10containerd-stable2.1.6-0ubuntu1~25.10.2UBUNTU-CVE-2026-47262
Ubuntu:26.04:LTScontainerd-stable2.2.2-0ubuntu1.1UBUNTU-CVE-2026-47262

Affected products (as reported)

VendorProductVersions
containerd containerd >= 1.7.0, < 1.7.33>= 2.0.0, < 2.0.10>= 2.1.0, < 2.1.9>= 2.2.0, < 2.2.5>= 2.3.0, < 2.3.2

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References